Secure communications using pre-shared keys

Abstract

The described techniques address issues to achieve key agreement without the need to exchange separate key agreement messages and, consequently, meets the stringent starting time requirements for real-time control systems. This is achieved using a group-wide key counter, with each node storing the latest value of this counter that was observed via the last received secured message. This counter value increases monotonically, and nodes maintain synchronization by transmitting this counter value (or a representation of the counter value) in each secured message.

What is claimed is: 
     
         1 . A transmitting node in a system of interconnected nodes configured to communicate over a bus according to a multi-drop scheme, the transmitting node comprising:
 processing circuitry configured to:
 derive, from a shared secret and a counter value, a temporary session key in accordance with a cryptographic function, the counter value and the shared secret being stored in non-volatile memory; and 
 generate a secured message using the temporary session key, the secured message comprising a plurality of fields, with a first one of the plurality of fields comprising a representation of the counter value; and 
   communication circuitry configured to transmit the secured message to the bus.   
     
     
         2 . The transmitting node of  claim 1 , wherein the representation of the counter value in the secured message enables a receiving node to derive the temporary session key from the counter value and the shared secret. 
     
     
         3 . The transmitting node of  claim 1 , wherein a second one of the plurality of fields comprises a secure channel indicator (SCI) value that identifies the transmitting node, and
 wherein the transmitting node is part of a secure zone comprising nodes within the system of interconnected nodes that are intended recipients of the secured message.   
     
     
         4 . The transmitting node of  claim 1 , wherein the processing circuitry is further configured to compute an integrity check value (ICV) based upon at least the counter value, and
 generate the secured message having a second one of the plurality of fields comprising the ICV.   
     
     
         5 . The transmitting node of  claim 1 , wherein:
 the processing circuitry is configured to derive, from the shared secret and the counter value, a further temporary session key in accordance with the cryptographic function, the further shared secret being stored in the non-volatile memory,   the temporary session key enables a receiving node to decrypt the secured message, and   the further temporary key enables a receiving node to authenticate the secured message.   
     
     
         6 . The transmitting node of  claim 1 , wherein the system of interconnected nodes comprises a plurality of secure zones, each one of the plurality of secure zones comprising a respective group of nodes, and
 wherein the processing circuitry is configured to generate the secured message having a second one of the plurality of fields comprising a secure channel indicator (SCI) value that indicates which one of the plurality of secure zones for which the secured message is intended.   
     
     
         7 . The transmitting node of  claim 6 , wherein the non-volatile memory stores, for each one of the plurality of secure zones, a respective shared secret and a respective counter value. 
     
     
         8 . The transmitting node of  claim 1 , wherein the processing circuitry is further configured to:
 generate, for each one of a plurality of secure zones comprising a respective group of nodes, a respective temporary session key using a respective shared secret and a respective counter value in accordance with a respective cryptographic function, and   generate, for a transmission to each respective group of nodes, a respective secured message comprising a plurality of fields, with a first one of the plurality of fields comprising a representation of the respective counter value, and   wherein the communication circuitry is configured to transmit each respective secured message to each respective group of nodes from among the plurality of secure zones.   
     
     
         9 . The transmitting node of  claim 1 , wherein the processing circuitry is configured to increment the counter value in response to one or more predefined conditions being satisfied, and to generate, from the shared secret and the incremented counter value, an updated temporary session key in accordance with the cryptographic function. 
     
     
         10 . The transmitting node of  claim 9 , wherein the one or more predefined conditions comprise a number of secured messages being transmitted with the temporary session key in excess of a predetermined number of messages and/or an expiration of a predetermined time period. 
     
     
         11 . The transmitting node of  claim 9 , wherein the non-volatile memory is configured to store a priority flag for a predetermined time period, and
 wherein the processing circuitry is configured to increment the counter value in response to the one or more predefined conditions being satisfied further conditioned upon a presence of the priority flag stored in the non-volatile memory.   
     
     
         12 . The transmitting node of  claim 9 , wherein the processing circuitry is configured to increment the counter value as part of an atomic storage algorithm. 
     
     
         13 . The transmitting node of  claim 1 , further comprising:
 a volatile memory configured to store the temporary session key.   
     
     
         14 . The transmitting node of  claim 1 , wherein the communication circuitry is configured to transmit the secured message in accordance with a communication protocol comprising one of a Controller Area Network (CAN) communication protocol, a Controller Area Network Flexible Data-Rate (CAN FD) communication protocol, a Controller Area Network Extra Long (CAN XL) communication protocol, or a multi-drop Ethernet communication protocol. 
     
     
         15 . The transmitting node of  claim 1 , wherein the plurality of fields form at least part of a communication protocol frame, and
 wherein the communication protocol frame comprises one of a Controller Area Network (CAN) communication protocol frame, a Controller Area Network Flexible Data-Rate (CAN FD) communication protocol frame, a Controller Area Network Extra Long (CAN XL) communication protocol frame, or an Ethernet communication protocol frame.   
     
     
         16 . A receiving node in a system of interconnected nodes, the system of interconnected nodes communicating over a bus according to a multi-drop scheme, the receiving node comprising:
 communication circuitry configured to receive a secured message via the bus, the secured message comprising a plurality of fields, with a first one of the plurality of fields comprising a representation of a first counter value that was used to derive a first temporary session key for generating the secured message in accordance with a cryptographic function prior to the secured message being received; and   processing circuitry configured to:
 compute the first counter value from the representation of the first counter value contained in the secured message; 
 determine a validity of the first counter value based upon (i) whether the computed first counter value matches a second counter value that is stored in a non-volatile memory of the receiving node, and/or (ii) whether the secured message is verified based upon a second temporary session key, which is derived from a shared secret stored in the non-volatile memory and the computed first counter value; and 
 accept or reject the secured message based upon the determined validity of the first counter value. 
   
     
     
         17 . The receiving node of  claim 16 , wherein the processing circuitry is configured to accept the secured message when the first counter value is valid as a result of the computed first counter value matching the second counter value. 
     
     
         18 . The receiving node of  claim 16 , wherein the processing circuitry is configured to determine that the first counter is invalid and to conditionally reject the secured message when the computed first counter value is less than the second counter value. 
     
     
         19 . The receiving node of  claim 16 , wherein the secured message includes a second one of the plurality of fields comprising an integrity check value (ICV), and wherein the processing circuitry is configured to:
 decrypt a payload of the secured message using the second temporary session key;   compute an ICV value from the decrypted payload, and   authenticate the representation of the first counter value contained in the secured message when the computed ICV value matches the ICV value contained in the secured message.   
     
     
         20 . The receiving node of  claim 16 , wherein a second one of the plurality of fields of the secured message comprises a secure channel indicator (SCI) value that identifies a secure zone comprising nodes within the system of interconnected nodes that are intended recipients of the secured message. 
     
     
         21 . The receiving node of  claim 16 , wherein the processing circuitry is further configured to:
 update the second counter value to match the computed first counter value when the second counter value is less than the computed first counter value; and   not update the second counter value when the computed first counter value already matches the second counter value.   
     
     
         22 . The receiving node of  claim 19 , wherein the processing circuitry is further configured to:
 selectively update, based upon the determined validity of the first counter value, the second temporary session key to match the first temporary session key; and   decrypt a payload of the secured message using the second temporary session key that matches the first temporary session key.   
     
     
         23 . The receiving node of  claim 16 , further comprising:
 a volatile memory configured to store the second temporary session key.   
     
     
         24 . The receiving node of  claim 16 , wherein the communication circuitry is configured to receive the secured message in accordance with a communication protocol comprising one of a Controller Area Network (CAN) communication protocol, a Controller Area Network Flexible Data-Rate (CAN FD) communication protocol, a Controller Area Network Extra Long (CAN XL) communication protocol, or a multi-drop Ethernet communication protocol. 
     
     
         25 . The receiving node of  claim 16 , wherein the plurality of fields form at least part of a communication protocol frame, and wherein the communication protocol frame comprises one of a Controller Area Network (CAN) communication protocol frame, a Controller Area Network Flexible Data-Rate (CAN FD) communication protocol frame, a Controller Area Network Extra Long (CAN XL) communication protocol frame, or an Ethernet communication protocol frame. 
     
     
         26 . A computer implemented method for transmitting a secured message via a transmitting node in a system of interconnected nodes configured to communicate over a bus, the method comprising:
 generating, from a shared secret and a counter value, a temporary session key in accordance with a cryptographic function, the counter value and the shared secret being stored in non-volatile memory of the transmitting node;   generating the secured message using the temporary session key, the secured message comprising a plurality of fields, with a first one of the plurality of fields comprising a representation of the counter value; and   transmitting the secured message to the bus.   
     
     
         27 . The computer implemented method of  claim 26 , wherein transmitting the secured message comprises:
 transmitting the secured message in accordance with a communication protocol comprising one of a Controller Area Network (CAN) communication protocol, a Controller Area Network Flexible Data-Rate (CAN FD) communication protocol, a Controller Area Network Extra Long (CAN XL) communication protocol, or a multi-drop Ethernet communication protocol.   
     
     
         28 . A computer implemented method for receiving a secured message via a receiving node in a system of interconnected nodes configured to communicate over a bus, the method comprising:
 receiving a secured message via the bus, the secured message comprising a plurality of fields, with a first one of the plurality of fields comprising a representation of a first counter value that was used to derive a first temporary session key for generating the secured message in accordance with a cryptographic function prior to the secured message being received;   computing the first counter value from the representation of the first counter value contained in the secured message;   determining a validity of the first counter value based upon (i) whether the computed first counter value matches a second counter value that is stored in a non-volatile memory of the receiving node, and/or (ii) whether the secured message is verified based upon a second temporary session key, which is derived from a shared secret stored in the non-volatile memory and the computed first counter value; and   accepting or rejecting the secured message based upon the determined validity of the first counter value.   
     
     
         29 . The computer implemented method of  claim 28 , wherein receiving the secured message comprises:
 receiving the secured message in accordance with a communication protocol comprising one of a Controller Area Network (CAN) communication protocol, a Controller Area Network Flexible Data-Rate (CAN FD) communication protocol, a Controller Area Network Extra Long (CAN XL) communication protocol, or a multi-drop Ethernet communication protocol.